TechnologyReviewed 18 August 2026

QR-code phishing

A pasted-over or messaged QR code opens a lookalike login or payment page—or attempts to install malware.

WHY IT WORKS

The hook

Scanning feels quick and hides the destination until the phone has already opened it.

WHAT THEY WANT

The endgame

Credentials, card details, unauthorized payment, or device compromise.

WHAT TO NOTICE

Three repeating signals

01
A sticker covers the original code
02
The message urges immediate scanning
03
The destination domain does not exactly match the organization

IF YOU ALREADY ACTED

Move quickly, without panic

Change credentials entered on the page
Contact the card issuer if you paid
Update and scan the device if anything downloaded

Recovery depends on the payment method and circumstances. Contact the relevant bank, platform or local authority using independently verified details.